Loading malware…
WINGHOOK is a shared-library keylogger targeting Linux and Unix-based operating systems. It hooks the read and fgets functions to intercept user input within the process that loads it. Captured keystrokes and host and user information are stored locally in encoded or encrypted logs. A companion utility, WINGCRACK, decodes and displays the captured data.
WINGHOOK has been deployed by the financially motivated threat actor UNC2891 in banking intrusions involving ATM switching and related infrastructure, including Indonesian banks. Observed deployments used modified SSH binaries to load the malicious shared library, enabling input capture within SSH processes. Encoded and encrypted logging helps conceal the collected information.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
WINGHOOK is a Linux .so-library with a capability to intercept user’s keystrokes from a process in which WINGHOOK is loaded.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
The threat actor modified software binaries to ensure persistence on the compromised hosts.
"UNC2891 deployed a range of custom malware, including CAKETAP (a Solaris/Linux rootkit)... attackers maintained undetected access for years"
The threat actor employed multiple obfuscation techniques, including payload and string encryption.
The threat actor disguised deployed malware with legitimate-looking names.
"UNC2891 frequently used the uuencoding scheme to encode and decode files..." and "WINGCRACK is a utility that can decode and display the content of files containing encoded keylog data"
WINGHOOK captured data and stored it in an encrypted log file located at /var/tmp/.zmanDwJ2Og.
WINGHOOK captured data and stored it in an encrypted log file located at /var/tmp/.zmanDwJ2Og.
MITRE list: "T1105:Ingress Tool Transfer" and description of deploying multiple utilities/toolkit components.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.